archive/jdk
1
0
Fork 0
mirror of https://github.com/openjdk/jdk.git synced 2025-08-27 14:54:52 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

8300140: ZipFile.isSignatureRelated returns true for files in META-INF subdirectories

Browse source 
Reviewed-by: weijun
This commit is contained in:
Eirik Bjorsnos 2023-01-27 22:47:51 +00:00 • committed by Weijun Wang
parent 5c59de52a3
commit 5dfc4ec7d9
6 changed files with 422 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

11
src/java.base/share/classes/java/util/jar/JarVerifier.java
View file

@ -1,5 +1,5 @@
/*
* Copyright (c) 1997, 2022, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 1997, 2023, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@ -39,6 +39,8 @@ import sun.security.util.ManifestEntryVerifier;
import sun.security.util.SignatureFileVerifier;
import sun.security.util.Debug;
import static sun.security.util.SignatureFileVerifier.isInMetaInf;
/**
*
* @author Roland Schemers
@ -135,15 +137,14 @@ class JarVerifier {
*/
if (parsingMeta) {
String uname = name.toUpperCase(Locale.ENGLISH);
if ((uname.startsWith("META-INF/") ||
uname.startsWith("/META-INF/"))) {
if (isInMetaInf(name)) {
if (je.isDirectory()) {
mev.setEntry(null, je);
return;
}
String uname = name.toUpperCase(Locale.ENGLISH);
if (uname.equals(JarFile.MANIFEST_NAME) ||
uname.equals(JarIndex.INDEX_NAME)) {
return;

21
src/java.base/share/classes/java/util/zip/ZipFile.java
View file

@ -1,5 +1,5 @@
/*
* Copyright (c) 1995, 2022, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 1995, 2023, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@ -1745,8 +1745,27 @@ public class ZipFile implements ZipConstants, Closeable {
assert(signatureRelated == SignatureFileVerifier
.isBlockOrSF(new String(name, off, len, UTF_8.INSTANCE)
.toUpperCase(Locale.ENGLISH)));
// Signature related files must reside directly in META-INF/
if (signatureRelated && hasSlash(name, off + META_INF_LEN, off + len)) {
signatureRelated = false;
}
return signatureRelated;
}
/*
* Return true if the encoded name contains a '/' within the byte given range
* This assumes an ASCII-compatible encoding, which is ok here since
* it is already assumed in isMetaName
*/
private boolean hasSlash(byte[] name, int start, int end) {
for (int i = start; i < end; i++) {
int c = name[i];
if (c == '/') {
return true;
}
}
return false;
}
/*
* If the bytes represents a non-directory name beginning